Organizations don't need better vulnerability scanners; they need to know who owns their assets and has the authority and capacity to actually fix them.